1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set

Information

Do not allow all requests.

Rationale:

Setting admission control plugin AlwaysAdmit allows all requests and does not filter any requests.

The AlwaysAdmit admission controller was deprecated in Kubernetes v1.13. Its behavior was equivalent to turning off all admission controllers.

Impact:

Only requests explicitly allowed by the admissions control plugins would be served.

Solution

None.

Default Value:

This AlwaysAdmit controller is disabled by default in OpenShift and cannot be enabled.

See Also

https://workbench.cisecurity.org/benchmarks/16094

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: OpenShift

Control ID: addb4bd8e98230229d8402a505225b2c494423db0210dce75b954afc6d622530